fix: unbreak the native image builds

[marc0olo]

main is red in soon-market-api and event-processor-contract. Both are regressions from #2 and #3 in this repo, and both are visible only in a native build — which is why every PR went green.

1. The startup observer was package private

Error: Discovered unresolved method during parsing:
  com.kryptokrauts.soonmarket.service.common.ApplicationCache.populateCachesAtStartup(io.quarkus.runtime.StartupEvent).
  … because class ApplicationCache_Subclass is registered for linking at image build time

soon-market-api has ApplicationCache extends BaseCache, in a different package. @ActivateRequestContext makes Arc generate a subclass, and a generated subclass cannot override a package-private method across packages — so native image cannot resolve it and fails the build.

populateCachesAtStartup is now public, and fillSafely protected for the same reason.

2. beanutils 1.11 drags commons-logging 1.3

Error: Class initialization of org.apache.commons.logging.impl.Log4jApiLogFactory failed
Caused by: java.lang.NoClassDefFoundError: org/apache/logging/log4j/spi/LoggerAdapter

Measured:

beanutils 1.9.4  →  commons-logging:1.2
beanutils 1.11.0 →  commons-logging:1.3.5

commons-logging 1.3 added Log4jApiLogFactory, which references log4j-api. That is not a dependency here, and native image initialises the class at build time, so the processor's image build dies.

commons-logging is pinned back to 1.2 — the version beanutils 1.9.4 used, so this returns the classpath to the state that built green for a year. The beanutils bump and its CVE fix are kept; the commons-logging API is unchanged between 1.2 and 1.3, only the factory implementations differ.

Verified with the processor's submodule pointed at this branch:

[INFO] \- commons-logging:commons-logging:jar:1.2:compile

What I could not verify, and why this slipped through

I have neither Docker nor GraalVM available locally, so the native builds are unverified — CI on the consumer repos is the gate. Fix 2 is high confidence because it restores an exact previously-working classpath; fix 1 is the documented resolution for that error but is untested by me.

The reason this reached main: no _validate.yml runs a native build. -Dnative appears only in the Dockerfiles, which run in push.yml on a push to main. So a native-only regression cannot be caught by a PR in any of these repos, by construction. That is worth fixing separately — a native build in _validate.yml would be slow, but a native-only failure mode that only appears after merge is worse. Related: kryptokrauts/event-processor-contract#25, where the native build args are declared three times and only the last applies.

After merging

The four consumers need their submodule pointers moved again — they are all at b5c80fb, which is the broken commit. soon-market-api and event-processor-contract are the two that are actually red; scheduled-task-service and soon-market-sse-api share the classpath change and should be moved with them.